annotate src/event/ngx_event_openssl.c @ 416:b4f69f2ef02c NGINX_0_7_20

nginx 0.7.20 *) Changes in the ngx_http_gzip_filter_module. *) Feature: the ngx_http_limit_req_module. *) Bugfix: worker processes might exit on a SIGBUS signal on sparc and ppc platforms; the bug had appeared in 0.7.3. Thanks to Maxim Dounin. *) Bugfix: the "proxy_pass http://host/some:uri" directives did not work; the bug had appeared in 0.7.12. *) Bugfix: in HTTPS mode requests might fail with the "bad write retry" error. *) Bugfix: the ngx_http_secure_link_module did not work inside locations, whose names are less than 3 characters. *) Bugfix: $server_addr variable might have no value.
author Igor Sysoev <http://sysoev.ru>
date Mon, 10 Nov 2008 00:00:00 +0300
parents 05981f639d21
children ad0a34a8efa6
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
2 /*
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
3 * Copyright (C) Igor Sysoev
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
4 */
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
5
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
6
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
7 #include <ngx_config.h>
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
8 #include <ngx_core.h>
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
9 #include <ngx_event.h>
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
10
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
11
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
12 typedef struct {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
13 ngx_str_t engine;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
14 } ngx_openssl_conf_t;
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
15
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
16
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
17 static int ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
18 static void ngx_ssl_handshake_handler(ngx_event_t *ev);
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
19 static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
20 static void ngx_ssl_write_handler(ngx_event_t *wev);
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
21 static void ngx_ssl_read_handler(ngx_event_t *rev);
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
22 static void ngx_ssl_shutdown_handler(ngx_event_t *ev);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
23 static void ngx_ssl_connection_error(ngx_connection_t *c, int sslerr,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
24 ngx_err_t err, char *text);
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
25 static void ngx_ssl_clear_error(ngx_log_t *log);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
26
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
27 static ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
28 void *data);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
29 static int ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
30 ngx_ssl_session_t *sess);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
31 static ngx_ssl_session_t *ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
32 u_char *id, int len, int *copy);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
33 static void ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
34 static void ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
35 ngx_slab_pool_t *shpool, ngx_uint_t n);
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
36 static void ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
37 ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
38
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
39 static void *ngx_openssl_create_conf(ngx_cycle_t *cycle);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
40 static char *ngx_openssl_init_conf(ngx_cycle_t *cycle, void *conf);
120
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
41 static void ngx_openssl_exit(ngx_cycle_t *cycle);
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
42
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
43 #if !(NGX_SSL_ENGINE)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
44 static char *ngx_openssl_noengine(ngx_conf_t *cf, ngx_command_t *cmd,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
45 void *conf);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
46 #endif
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
47
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
48
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
49 static ngx_command_t ngx_openssl_commands[] = {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
50
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
51 { ngx_string("ssl_engine"),
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
52 NGX_MAIN_CONF|NGX_DIRECT_CONF|NGX_CONF_TAKE1,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
53 #if (NGX_SSL_ENGINE)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
54 ngx_conf_set_str_slot,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
55 #else
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
56 ngx_openssl_noengine,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
57 #endif
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
58 0,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
59 offsetof(ngx_openssl_conf_t, engine),
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
60 NULL },
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
61
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
62 ngx_null_command
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
63 };
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
64
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
65
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
66 static ngx_core_module_t ngx_openssl_module_ctx = {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
67 ngx_string("openssl"),
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
68 ngx_openssl_create_conf,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
69 ngx_openssl_init_conf
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
70 };
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
71
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
72
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
73 ngx_module_t ngx_openssl_module = {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
74 NGX_MODULE_V1,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
75 &ngx_openssl_module_ctx, /* module context */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
76 ngx_openssl_commands, /* module directives */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
77 NGX_CORE_MODULE, /* module type */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
78 NULL, /* init master */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
79 NULL, /* init module */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
80 NULL, /* init process */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
81 NULL, /* init thread */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
82 NULL, /* exit thread */
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
83 NULL, /* exit process */
120
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
84 ngx_openssl_exit, /* exit master */
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
85 NGX_MODULE_V1_PADDING
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
86 };
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
87
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
88
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
89 static long ngx_ssl_protocols[] = {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
90 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
91 SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
92 SSL_OP_NO_SSLv2|SSL_OP_NO_TLSv1,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
93 SSL_OP_NO_TLSv1,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
94 SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
95 SSL_OP_NO_SSLv3,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
96 SSL_OP_NO_SSLv2,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
97 0,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
98 };
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
99
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
100
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
101 int ngx_ssl_connection_index;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
102 int ngx_ssl_server_conf_index;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
103 int ngx_ssl_session_cache_index;
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
104
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
105
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
106 ngx_int_t
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
107 ngx_ssl_init(ngx_log_t *log)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
108 {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
109 #if OPENSSL_VERSION_NUMBER >= 0x00907000
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
110 OPENSSL_config(NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
111 #endif
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
112
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
113 SSL_library_init();
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
114 SSL_load_error_strings();
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
115
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
116 #if (NGX_SSL_ENGINE)
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
117 ENGINE_load_builtin_engines();
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
118 #endif
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
119
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
120 ngx_ssl_connection_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
121
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
122 if (ngx_ssl_connection_index == -1) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
123 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "SSL_get_ex_new_index() failed");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
124 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
125 }
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
126
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
127 ngx_ssl_server_conf_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
128 NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
129 if (ngx_ssl_server_conf_index == -1) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
130 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
131 "SSL_CTX_get_ex_new_index() failed");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
132 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
133 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
134
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
135 ngx_ssl_session_cache_index = SSL_CTX_get_ex_new_index(0, NULL, NULL, NULL,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
136 NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
137 if (ngx_ssl_session_cache_index == -1) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
138 ngx_ssl_error(NGX_LOG_ALERT, log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
139 "SSL_CTX_get_ex_new_index() failed");
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
140 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
141 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
142
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
143 return NGX_OK;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
144 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
145
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
146
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
147 ngx_int_t
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
148 ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
149 {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
150 ssl->ctx = SSL_CTX_new(SSLv23_method());
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
151
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
152 if (ssl->ctx == NULL) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
153 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "SSL_CTX_new() failed");
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
154 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
155 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
156
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
157 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_server_conf_index, data) == 0) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
158 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
159 "SSL_CTX_set_ex_data() failed");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
160 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
161 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
162
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
163 /* client side options */
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
164
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
165 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_SESS_ID_BUG);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
166 SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_CHALLENGE_BUG);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
167 SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
168
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
169 /* server side options */
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
170
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
171 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
172 SSL_CTX_set_options(ssl->ctx, SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
173
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
174 /* this option allow a potential SSL 2.0 rollback (CAN-2005-2969) */
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
175 SSL_CTX_set_options(ssl->ctx, SSL_OP_MSIE_SSLV2_RSA_PADDING);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
176
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
177 SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLEAY_080_CLIENT_DH_BUG);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
178 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_D5_BUG);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
179 SSL_CTX_set_options(ssl->ctx, SSL_OP_TLS_BLOCK_PADDING_BUG);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
180
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
181 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
182 SSL_CTX_set_options(ssl->ctx, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
183 #endif
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
184
380
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
185 SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
186
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
187 if (ngx_ssl_protocols[protocols >> 1] != 0) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
188 SSL_CTX_set_options(ssl->ctx, ngx_ssl_protocols[protocols >> 1]);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
189 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
190
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
191 SSL_CTX_set_read_ahead(ssl->ctx, 1);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
192
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
193 return NGX_OK;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
194 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
195
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
196
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
197 ngx_int_t
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
198 ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
199 ngx_str_t *key)
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
200 {
324
f7cd062ee035 nginx 0.6.6
Igor Sysoev <http://sysoev.ru>
parents: 302
diff changeset
201 if (ngx_conf_full_name(cf->cycle, cert, 1) == NGX_ERROR) {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
202 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
203 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
204
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
205 if (SSL_CTX_use_certificate_chain_file(ssl->ctx, (char *) cert->data)
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
206 == 0)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
207 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
208 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
209 "SSL_CTX_use_certificate_chain_file(\"%s\") failed",
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
210 cert->data);
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
211 return NGX_ERROR;
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
212 }
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
213
324
f7cd062ee035 nginx 0.6.6
Igor Sysoev <http://sysoev.ru>
parents: 302
diff changeset
214 if (ngx_conf_full_name(cf->cycle, key, 1) == NGX_ERROR) {
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
215 return NGX_ERROR;
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
216 }
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
217
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
218 if (SSL_CTX_use_PrivateKey_file(ssl->ctx, (char *) key->data,
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
219 SSL_FILETYPE_PEM)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
220 == 0)
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
221 {
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
222 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
223 "SSL_CTX_use_PrivateKey_file(\"%s\") failed", key->data);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
224 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
225 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
226
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
227 return NGX_OK;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
228 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
229
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
230
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
231 ngx_int_t
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
232 ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
233 ngx_int_t depth)
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
234 {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
235 STACK_OF(X509_NAME) *list;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
236
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
237 SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_http_ssl_verify_callback);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
238
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
239 SSL_CTX_set_verify_depth(ssl->ctx, depth);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
240
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
241 if (cert->len == 0) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
242 return NGX_OK;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
243 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
244
324
f7cd062ee035 nginx 0.6.6
Igor Sysoev <http://sysoev.ru>
parents: 302
diff changeset
245 if (ngx_conf_full_name(cf->cycle, cert, 1) == NGX_ERROR) {
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
246 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
247 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
248
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
249 if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
250 == 0)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
251 {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
252 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
253 "SSL_CTX_load_verify_locations(\"%s\") failed",
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
254 cert->data);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
255 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
256 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
257
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
258 list = SSL_load_client_CA_file((char *) cert->data);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
259
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
260 if (list == NULL) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
261 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
262 "SSL_load_client_CA_file(\"%s\") failed", cert->data);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
263 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
264 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
265
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
266 /*
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
267 * before 0.9.7h and 0.9.8 SSL_load_client_CA_file()
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
268 * always leaved an error in the error queue
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
269 */
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
270
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
271 ERR_clear_error();
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
272
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
273 SSL_CTX_set_client_CA_list(ssl->ctx, list);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
274
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
275 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
276 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
277
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
278
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
279 static int
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
280 ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
281 {
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
282 #if (NGX_DEBUG)
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
283 char *subject, *issuer;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
284 int err, depth;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
285 X509 *cert;
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
286 X509_NAME *sname, *iname;
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
287 ngx_connection_t *c;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
288 ngx_ssl_conn_t *ssl_conn;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
289
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
290 ssl_conn = X509_STORE_CTX_get_ex_data(x509_store,
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
291 SSL_get_ex_data_X509_STORE_CTX_idx());
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
292
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
293 c = ngx_ssl_get_connection(ssl_conn);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
294
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
295 cert = X509_STORE_CTX_get_current_cert(x509_store);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
296 err = X509_STORE_CTX_get_error(x509_store);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
297 depth = X509_STORE_CTX_get_error_depth(x509_store);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
298
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
299 sname = X509_get_subject_name(cert);
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
300 subject = sname ? X509_NAME_oneline(sname, NULL, 0) : "(none)";
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
301
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
302 iname = X509_get_issuer_name(cert);
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
303 issuer = iname ? X509_NAME_oneline(iname, NULL, 0) : "(none)";
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
304
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
305 ngx_log_debug5(NGX_LOG_DEBUG_EVENT, c->log, 0,
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
306 "verify:%d, error:%d, depth:%d, "
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
307 "subject:\"%s\",issuer: \"%s\"",
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
308 ok, err, depth, subject, issuer);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
309
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
310 if (sname) {
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
311 OPENSSL_free(subject);
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
312 }
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
313
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
314 if (iname) {
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
315 OPENSSL_free(issuer);
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
316 }
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
317 #endif
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
318
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
319 return 1;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
320 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
321
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
322
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
323 ngx_int_t
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
324 ngx_ssl_generate_rsa512_key(ngx_ssl_t *ssl)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
325 {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
326 RSA *key;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
327
108
cf3d6edb3ad6 nginx 0.3.1
Igor Sysoev <http://sysoev.ru>
parents: 98
diff changeset
328 if (SSL_CTX_need_tmp_RSA(ssl->ctx) == 0) {
cf3d6edb3ad6 nginx 0.3.1
Igor Sysoev <http://sysoev.ru>
parents: 98
diff changeset
329 return NGX_OK;
cf3d6edb3ad6 nginx 0.3.1
Igor Sysoev <http://sysoev.ru>
parents: 98
diff changeset
330 }
cf3d6edb3ad6 nginx 0.3.1
Igor Sysoev <http://sysoev.ru>
parents: 98
diff changeset
331
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
332 key = RSA_generate_key(512, RSA_F4, NULL, NULL);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
333
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
334 if (key) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
335 SSL_CTX_set_tmp_rsa(ssl->ctx, key);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
336
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
337 RSA_free(key);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
338
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
339 return NGX_OK;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
340 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
341
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
342 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "RSA_generate_key(512) failed");
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
343
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
344 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
345 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
346
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
347
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
348 ngx_int_t
380
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
349 ngx_ssl_dhparam(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *file)
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
350 {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
351 DH *dh;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
352 BIO *bio;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
353
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
354 /*
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
355 * -----BEGIN DH PARAMETERS-----
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
356 * MIGHAoGBALu8LcrYRnSQfEP89YDpz9vZWKP1aLQtSwju1OsPs1BMbAMCducQgAxc
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
357 * y7qokiYUxb7spWWl/fHSh6K8BJvmd4Bg6RqSp1fjBI9osHb302zI8pul34HcLKcl
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
358 * 7OZicMyaUDXYzs7vnqAnSmOrHlj6/UmI0PZdFGdX2gcd8EXP4WubAgEC
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
359 * -----END DH PARAMETERS-----
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
360 */
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
361
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
362 static unsigned char dh1024_p[] = {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
363 0xBB, 0xBC, 0x2D, 0xCA, 0xD8, 0x46, 0x74, 0x90, 0x7C, 0x43, 0xFC, 0xF5,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
364 0x80, 0xE9, 0xCF, 0xDB, 0xD9, 0x58, 0xA3, 0xF5, 0x68, 0xB4, 0x2D, 0x4B,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
365 0x08, 0xEE, 0xD4, 0xEB, 0x0F, 0xB3, 0x50, 0x4C, 0x6C, 0x03, 0x02, 0x76,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
366 0xE7, 0x10, 0x80, 0x0C, 0x5C, 0xCB, 0xBA, 0xA8, 0x92, 0x26, 0x14, 0xC5,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
367 0xBE, 0xEC, 0xA5, 0x65, 0xA5, 0xFD, 0xF1, 0xD2, 0x87, 0xA2, 0xBC, 0x04,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
368 0x9B, 0xE6, 0x77, 0x80, 0x60, 0xE9, 0x1A, 0x92, 0xA7, 0x57, 0xE3, 0x04,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
369 0x8F, 0x68, 0xB0, 0x76, 0xF7, 0xD3, 0x6C, 0xC8, 0xF2, 0x9B, 0xA5, 0xDF,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
370 0x81, 0xDC, 0x2C, 0xA7, 0x25, 0xEC, 0xE6, 0x62, 0x70, 0xCC, 0x9A, 0x50,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
371 0x35, 0xD8, 0xCE, 0xCE, 0xEF, 0x9E, 0xA0, 0x27, 0x4A, 0x63, 0xAB, 0x1E,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
372 0x58, 0xFA, 0xFD, 0x49, 0x88, 0xD0, 0xF6, 0x5D, 0x14, 0x67, 0x57, 0xDA,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
373 0x07, 0x1D, 0xF0, 0x45, 0xCF, 0xE1, 0x6B, 0x9B
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
374 };
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
375
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
376 static unsigned char dh1024_g[] = { 0x02 };
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
377
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
378
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
379 if (file->len == 0) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
380
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
381 dh = DH_new();
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
382 if (dh == NULL) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
383 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "DH_new() failed");
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
384 return NGX_ERROR;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
385 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
386
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
387 dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
388 dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
389
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
390 if (dh->p == NULL || dh->g == NULL) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
391 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, "BN_bin2bn() failed");
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
392 DH_free(dh);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
393 return NGX_ERROR;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
394 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
395
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
396 SSL_CTX_set_tmp_dh(ssl->ctx, dh);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
397
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
398 DH_free(dh);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
399
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
400 return NGX_OK;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
401 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
402
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
403 if (ngx_conf_full_name(cf->cycle, file, 1) == NGX_ERROR) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
404 return NGX_ERROR;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
405 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
406
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
407 bio = BIO_new_file((char *) file->data, "r");
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
408 if (bio == NULL) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
409 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
410 "BIO_new_file(\"%s\") failed", file->data);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
411 return NGX_ERROR;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
412 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
413
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
414 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
415 if (dh == NULL) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
416 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
417 "PEM_read_bio_DHparams(\"%s\") failed", file->data);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
418 BIO_free(bio);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
419 return NGX_ERROR;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
420 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
421
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
422 SSL_CTX_set_tmp_dh(ssl->ctx, dh);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
423
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
424 DH_free(dh);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
425 BIO_free(bio);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
426
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
427 return NGX_OK;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
428 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
429
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
430
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
431 ngx_int_t
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
432 ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
433 {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
434 ngx_ssl_connection_t *sc;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
435
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
436 sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t));
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
437 if (sc == NULL) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
438 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
439 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
440
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
441 sc->buffer = ((flags & NGX_SSL_BUFFER) != 0);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
442
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
443 sc->connection = SSL_new(ssl->ctx);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
444
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
445 if (sc->connection == NULL) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
446 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_new() failed");
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
447 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
448 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
449
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
450 if (SSL_set_fd(sc->connection, c->fd) == 0) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
451 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_fd() failed");
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
452 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
453 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
454
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
455 if (flags & NGX_SSL_CLIENT) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
456 SSL_set_connect_state(sc->connection);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
457
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
458 } else {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
459 SSL_set_accept_state(sc->connection);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
460 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
461
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
462 if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
463 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_ex_data() failed");
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
464 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
465 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
466
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
467 c->ssl = sc;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
468
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
469 return NGX_OK;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
470 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
471
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
472
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
473 ngx_int_t
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
474 ngx_ssl_set_session(ngx_connection_t *c, ngx_ssl_session_t *session)
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
475 {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
476 if (session) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
477 if (SSL_set_session(c->ssl->connection, session) == 0) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
478 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "SSL_set_session() failed");
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
479 return NGX_ERROR;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
480 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
481 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
482
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
483 return NGX_OK;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
484 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
485
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
486
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
487 ngx_int_t
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
488 ngx_ssl_handshake(ngx_connection_t *c)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
489 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
490 int n, sslerr;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
491 ngx_err_t err;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
492
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
493 ngx_ssl_clear_error(c->log);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
494
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
495 n = SSL_do_handshake(c->ssl->connection);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
496
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
497 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
498
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
499 if (n == 1) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
500
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
501 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
502 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
503 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
504
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
505 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
506 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
507 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
508
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
509 #if (NGX_DEBUG)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
510 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
511 char buf[129], *s, *d;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
512 SSL_CIPHER *cipher;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
513
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
514 cipher = SSL_get_current_cipher(c->ssl->connection);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
515
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
516 if (cipher) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
517 SSL_CIPHER_description(cipher, &buf[1], 128);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
518
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
519 for (s = &buf[1], d = buf; *s; s++) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
520 if (*s == ' ' && *d == ' ') {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
521 continue;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
522 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
523
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
524 if (*s == LF || *s == CR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
525 continue;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
526 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
527
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
528 *++d = *s;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
529 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
530
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
531 if (*d != ' ') {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
532 d++;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
533 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
534
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
535 *d = '\0';
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
536
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
537 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
538 "SSL: %s, cipher: \"%s\"",
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
539 SSL_get_version(c->ssl->connection), &buf[1]);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
540
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
541 if (SSL_session_reused(c->ssl->connection)) {
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
542 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
543 "SSL reused session");
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
544 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
545
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
546 } else {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
547 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
548 "SSL no shared ciphers");
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
549 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
550 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
551 #endif
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
552
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
553 c->ssl->handshaked = 1;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
554
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
555 c->recv = ngx_ssl_recv;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
556 c->send = ngx_ssl_write;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
557 c->recv_chain = ngx_ssl_recv_chain;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
558 c->send_chain = ngx_ssl_send_chain;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
559
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
560 return NGX_OK;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
561 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
562
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
563 sslerr = SSL_get_error(c->ssl->connection, n);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
564
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
565 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
566
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
567 if (sslerr == SSL_ERROR_WANT_READ) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
568 c->read->ready = 0;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
569 c->read->handler = ngx_ssl_handshake_handler;
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
570 c->write->handler = ngx_ssl_handshake_handler;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
571
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
572 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
573 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
574 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
575
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
576 return NGX_AGAIN;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
577 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
578
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
579 if (sslerr == SSL_ERROR_WANT_WRITE) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
580 c->write->ready = 0;
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
581 c->read->handler = ngx_ssl_handshake_handler;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
582 c->write->handler = ngx_ssl_handshake_handler;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
583
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
584 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
585 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
586 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
587
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
588 return NGX_AGAIN;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
589 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
590
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
591 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
592
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
593 c->ssl->no_wait_shutdown = 1;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
594 c->ssl->no_send_shutdown = 1;
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
595 c->read->eof = 1;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
596
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
597 if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
598 ngx_log_error(NGX_LOG_INFO, c->log, err,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
599 "peer closed connection in SSL handshake");
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
600
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
601 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
602 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
603
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
604 c->read->error = 1;
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
605
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
606 ngx_ssl_connection_error(c, sslerr, err, "SSL_do_handshake() failed");
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
607
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
608 return NGX_ERROR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
609 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
610
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
611
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
612 static void
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
613 ngx_ssl_handshake_handler(ngx_event_t *ev)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
614 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
615 ngx_connection_t *c;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
616
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
617 c = ev->data;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
618
98
8bf57caa374a nginx 0.2.3
Igor Sysoev <http://sysoev.ru>
parents: 96
diff changeset
619 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
620 "SSL handshake handler: %d", ev->write);
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
621
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
622 if (ev->timedout) {
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
623 c->ssl->handler(c);
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
624 return;
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
625 }
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
626
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
627 if (ngx_ssl_handshake(c) == NGX_AGAIN) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
628 return;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
629 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
630
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
631 c->ssl->handler(c);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
632 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
633
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
634
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
635 ssize_t
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
636 ngx_ssl_recv_chain(ngx_connection_t *c, ngx_chain_t *cl)
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
637 {
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
638 u_char *last;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
639 ssize_t n, bytes;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
640 ngx_buf_t *b;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
641
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
642 bytes = 0;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
643
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
644 b = cl->buf;
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
645 last = b->last;
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
646
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
647 for ( ;; ) {
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
648
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
649 n = ngx_ssl_recv(c, last, b->end - last);
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
650
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
651 if (n > 0) {
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
652 last += n;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
653 bytes += n;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
654
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
655 if (last == b->end) {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
656 cl = cl->next;
294
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
657
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
658 if (cl == NULL) {
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
659 return bytes;
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
660 }
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
661
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
662 b = cl->buf;
27d9d1f26b38 nginx 0.5.17
Igor Sysoev <http://sysoev.ru>
parents: 276
diff changeset
663 last = b->last;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
664 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
665
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
666 continue;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
667 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
668
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
669 if (bytes) {
382
984bb0b1399b nginx 0.7.3
Igor Sysoev <http://sysoev.ru>
parents: 380
diff changeset
670
984bb0b1399b nginx 0.7.3
Igor Sysoev <http://sysoev.ru>
parents: 380
diff changeset
671 if (n == 0 || n == NGX_ERROR) {
984bb0b1399b nginx 0.7.3
Igor Sysoev <http://sysoev.ru>
parents: 380
diff changeset
672 c->read->ready = 1;
984bb0b1399b nginx 0.7.3
Igor Sysoev <http://sysoev.ru>
parents: 380
diff changeset
673 }
984bb0b1399b nginx 0.7.3
Igor Sysoev <http://sysoev.ru>
parents: 380
diff changeset
674
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
675 return bytes;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
676 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
677
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
678 return n;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
679 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
680 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
681
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
682
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
683 ssize_t
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
684 ngx_ssl_recv(ngx_connection_t *c, u_char *buf, size_t size)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
685 {
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
686 int n, bytes;
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
687
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
688 if (c->ssl->last == NGX_ERROR) {
330
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
689 c->read->error = 1;
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
690 return NGX_ERROR;
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
691 }
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
692
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
693 if (c->ssl->last == NGX_DONE) {
330
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
694 c->read->ready = 0;
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
695 c->read->eof = 1;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
696 return 0;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
697 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
698
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
699 bytes = 0;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
700
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
701 ngx_ssl_clear_error(c->log);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
702
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
703 /*
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
704 * SSL_read() may return data in parts, so try to read
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
705 * until SSL_read() would return no data
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
706 */
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
707
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
708 for ( ;; ) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
709
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
710 n = SSL_read(c->ssl->connection, buf, size);
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
711
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
712 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_read: %d", n);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
713
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
714 if (n > 0) {
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
715 bytes += n;
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
716 }
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
717
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
718 c->ssl->last = ngx_ssl_handle_recv(c, n);
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
719
330
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
720 if (c->ssl->last == NGX_OK) {
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
721
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
722 size -= n;
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
723
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
724 if (size == 0) {
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
725 return bytes;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
726 }
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
727
330
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
728 buf += n;
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
729
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
730 continue;
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
731 }
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
732
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
733 if (bytes) {
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
734 return bytes;
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
735 }
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
736
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
737 switch (c->ssl->last) {
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
738
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
739 case NGX_DONE:
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
740 c->read->ready = 0;
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
741 c->read->eof = 1;
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
742 return 0;
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
743
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
744 case NGX_ERROR:
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
745 c->read->error = 1;
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
746
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
747 /* fall thruogh */
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
748
5e3b425174f6 nginx 0.6.9
Igor Sysoev <http://sysoev.ru>
parents: 324
diff changeset
749 case NGX_AGAIN:
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
750 return c->ssl->last;
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
751 }
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
752 }
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
753 }
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
754
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
755
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
756 static ngx_int_t
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
757 ngx_ssl_handle_recv(ngx_connection_t *c, int n)
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
758 {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
759 int sslerr;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
760 ngx_err_t err;
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
761
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
762 if (n > 0) {
28
7ca9bdc82b3f nginx 0.1.14
Igor Sysoev <http://sysoev.ru>
parents: 22
diff changeset
763
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
764 if (c->ssl->saved_write_handler) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
765
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
766 c->write->handler = c->ssl->saved_write_handler;
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
767 c->ssl->saved_write_handler = NULL;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
768 c->write->ready = 1;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
769
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
770 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
771 return NGX_ERROR;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
772 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
773
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
774 ngx_post_event(c->write, &ngx_posted_events);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
775 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
776
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
777 return NGX_OK;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
778 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
779
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
780 sslerr = SSL_get_error(c->ssl->connection, n);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
781
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
782 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
783
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
784 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
785
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
786 if (sslerr == SSL_ERROR_WANT_READ) {
4
4b2dafa26fe2 nginx 0.1.2
Igor Sysoev <http://sysoev.ru>
parents: 2
diff changeset
787 c->read->ready = 0;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
788 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
789 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
790
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
791 if (sslerr == SSL_ERROR_WANT_WRITE) {
88
e916a291e9aa nginx 0.1.44
Igor Sysoev <http://sysoev.ru>
parents: 62
diff changeset
792
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
793 ngx_log_error(NGX_LOG_INFO, c->log, 0,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
794 "peer started SSL renegotiation");
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
795
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
796 c->write->ready = 0;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
797
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
798 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
799 return NGX_ERROR;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
800 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
801
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
802 /*
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
803 * we do not set the timer because there is already the read event timer
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
804 */
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
805
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
806 if (c->ssl->saved_write_handler == NULL) {
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
807 c->ssl->saved_write_handler = c->write->handler;
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
808 c->write->handler = ngx_ssl_write_handler;
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
809 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
810
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
811 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
812 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
813
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
814 c->ssl->no_wait_shutdown = 1;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
815 c->ssl->no_send_shutdown = 1;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
816
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
817 if (sslerr == SSL_ERROR_ZERO_RETURN || ERR_peek_error() == 0) {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
818 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
819 "peer shutdown SSL cleanly");
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
820 return NGX_DONE;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
821 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
822
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
823 ngx_ssl_connection_error(c, sslerr, err, "SSL_read() failed");
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
824
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
825 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
826 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
827
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
828
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
829 static void
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
830 ngx_ssl_write_handler(ngx_event_t *wev)
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
831 {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
832 ngx_connection_t *c;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
833
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
834 c = wev->data;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
835
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
836 c->read->handler(c->read);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
837 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
838
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
839
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
840 /*
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
841 * OpenSSL has no SSL_writev() so we copy several bufs into our 16K buffer
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
842 * before the SSL_write() call to decrease a SSL overhead.
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
843 *
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
844 * Besides for protocols such as HTTP it is possible to always buffer
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
845 * the output to decrease a SSL overhead some more.
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
846 */
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
847
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
848 ngx_chain_t *
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
849 ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
850 {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
851 int n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
852 ngx_uint_t flush;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
853 ssize_t send, size;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
854 ngx_buf_t *buf;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
855
416
b4f69f2ef02c nginx 0.7.20
Igor Sysoev <http://sysoev.ru>
parents: 394
diff changeset
856 if (!c->ssl->buffer) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
857
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
858 while (in) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
859 if (ngx_buf_special(in->buf)) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
860 in = in->next;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
861 continue;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
862 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
863
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
864 n = ngx_ssl_write(c, in->buf->pos, in->buf->last - in->buf->pos);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
865
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
866 if (n == NGX_ERROR) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
867 return NGX_CHAIN_ERROR;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
868 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
869
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
870 if (n == NGX_AGAIN) {
146
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
871 c->buffered |= NGX_SSL_BUFFERED;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
872 return in;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
873 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
874
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
875 in->buf->pos += n;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
876
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
877 if (in->buf->pos == in->buf->last) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
878 in = in->next;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
879 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
880 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
881
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
882 return in;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
883 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
884
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
885
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
886 /* the maximum limit size is the maximum uint32_t value - the page size */
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
887
324
f7cd062ee035 nginx 0.6.6
Igor Sysoev <http://sysoev.ru>
parents: 302
diff changeset
888 if (limit == 0 || limit > (off_t) (NGX_MAX_UINT32_VALUE - ngx_pagesize)) {
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
889 limit = NGX_MAX_UINT32_VALUE - ngx_pagesize;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
890 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
891
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
892 buf = c->ssl->buf;
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
893
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
894 if (buf == NULL) {
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
895 buf = ngx_create_temp_buf(c->pool, NGX_SSL_BUFSIZE);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
896 if (buf == NULL) {
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
897 return NGX_CHAIN_ERROR;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
898 }
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
899
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
900 c->ssl->buf = buf;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
901 }
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
902
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
903 if (buf->start == NULL) {
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
904 buf->start = ngx_palloc(c->pool, NGX_SSL_BUFSIZE);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
905 if (buf->start == NULL) {
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
906 return NGX_CHAIN_ERROR;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
907 }
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
908
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
909 buf->pos = buf->start;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
910 buf->last = buf->start;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
911 buf->end = buf->start + NGX_SSL_BUFSIZE;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
912 }
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
913
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
914 send = 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
915 flush = (in == NULL) ? 1 : 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
916
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
917 for ( ;; ) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
918
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
919 while (in && buf->last < buf->end) {
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
920 if (in->buf->last_buf || in->buf->flush) {
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
921 flush = 1;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
922 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
923
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
924 if (ngx_buf_special(in->buf)) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
925 in = in->next;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
926 continue;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
927 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
928
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
929 size = in->buf->last - in->buf->pos;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
930
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
931 if (size > buf->end - buf->last) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
932 size = buf->end - buf->last;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
933 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
934
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
935 if (send + size > limit) {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
936 size = (ssize_t) (limit - send);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
937 flush = 1;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
938 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
939
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
940 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
941 "SSL buf copy: %d", size);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
942
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
943 ngx_memcpy(buf->last, in->buf->pos, size);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
944
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
945 buf->last += size;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
946
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
947 in->buf->pos += size;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
948
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
949 if (in->buf->pos == in->buf->last) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
950 in = in->next;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
951 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
952 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
953
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
954 size = buf->last - buf->pos;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
955
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
956 if (!flush && buf->last < buf->end && c->ssl->buffer) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
957 break;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
958 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
959
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
960 n = ngx_ssl_write(c, buf->pos, size);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
961
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
962 if (n == NGX_ERROR) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
963 return NGX_CHAIN_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
964 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
965
60
df7d3fff122b nginx 0.1.30
Igor Sysoev <http://sysoev.ru>
parents: 58
diff changeset
966 if (n == NGX_AGAIN) {
146
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
967 c->buffered |= NGX_SSL_BUFFERED;
60
df7d3fff122b nginx 0.1.30
Igor Sysoev <http://sysoev.ru>
parents: 58
diff changeset
968 return in;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
969 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
970
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
971 buf->pos += n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
972 send += n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
973 c->sent += n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
974
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
975 if (n < size) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
976 break;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
977 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
978
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
979 if (buf->pos == buf->last) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
980 buf->pos = buf->start;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
981 buf->last = buf->start;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
982 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
983
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
984 if (in == NULL || send == limit) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
985 break;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
986 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
987 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
988
146
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
989 if (buf->pos < buf->last) {
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
990 c->buffered |= NGX_SSL_BUFFERED;
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
991
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
992 } else {
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
993 c->buffered &= ~NGX_SSL_BUFFERED;
36af50a5582d nginx 0.3.20
Igor Sysoev <http://sysoev.ru>
parents: 140
diff changeset
994 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
995
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
996 return in;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
997 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
998
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
999
88
e916a291e9aa nginx 0.1.44
Igor Sysoev <http://sysoev.ru>
parents: 62
diff changeset
1000 ssize_t
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
1001 ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1002 {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1003 int n, sslerr;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1004 ngx_err_t err;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1005
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1006 ngx_ssl_clear_error(c->log);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1007
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1008 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL to write: %d", size);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1009
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1010 n = SSL_write(c->ssl->connection, data, size);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1011
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1012 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_write: %d", n);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1013
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1014 if (n > 0) {
88
e916a291e9aa nginx 0.1.44
Igor Sysoev <http://sysoev.ru>
parents: 62
diff changeset
1015
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1016 if (c->ssl->saved_read_handler) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1017
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1018 c->read->handler = c->ssl->saved_read_handler;
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1019 c->ssl->saved_read_handler = NULL;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1020 c->read->ready = 1;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1021
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1022 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1023 return NGX_ERROR;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1024 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1025
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
1026 ngx_post_event(c->read, &ngx_posted_events);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1027 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1028
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1029 return n;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1030 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1031
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1032 sslerr = SSL_get_error(c->ssl->connection, n);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1033
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1034 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1035
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1036 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_get_error: %d", sslerr);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1037
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1038 if (sslerr == SSL_ERROR_WANT_WRITE) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1039 c->write->ready = 0;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1040 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1041 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1042
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1043 if (sslerr == SSL_ERROR_WANT_READ) {
2
cc9f381affaa nginx 0.1.1
Igor Sysoev <http://sysoev.ru>
parents: 0
diff changeset
1044
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1045 ngx_log_error(NGX_LOG_INFO, c->log, 0,
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1046 "peer started SSL renegotiation");
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1047
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1048 c->read->ready = 0;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1049
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1050 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1051 return NGX_ERROR;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1052 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1053
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1054 /*
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1055 * we do not set the timer because there is already
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1056 * the write event timer
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1057 */
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1058
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1059 if (c->ssl->saved_read_handler == NULL) {
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1060 c->ssl->saved_read_handler = c->read->handler;
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1061 c->read->handler = ngx_ssl_read_handler;
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1062 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1063
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1064 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1065 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1066
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1067 c->ssl->no_wait_shutdown = 1;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1068 c->ssl->no_send_shutdown = 1;
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
1069 c->write->error = 1;
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1070
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1071 ngx_ssl_connection_error(c, sslerr, err, "SSL_write() failed");
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1072
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1073 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1074 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1075
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1076
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
1077 static void
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
1078 ngx_ssl_read_handler(ngx_event_t *rev)
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1079 {
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1080 ngx_connection_t *c;
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1081
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1082 c = rev->data;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1083
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1084 c->write->handler(c->write);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1085 }
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1086
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1087
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1088 void
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1089 ngx_ssl_free_buffer(ngx_connection_t *c)
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1090 {
360
2b41fbc2e39e nginx 0.6.24
Igor Sysoev <http://sysoev.ru>
parents: 358
diff changeset
1091 if (c->ssl->buf && c->ssl->buf->start) {
2b41fbc2e39e nginx 0.6.24
Igor Sysoev <http://sysoev.ru>
parents: 358
diff changeset
1092 if (ngx_pfree(c->pool, c->ssl->buf->start) == NGX_OK) {
2b41fbc2e39e nginx 0.6.24
Igor Sysoev <http://sysoev.ru>
parents: 358
diff changeset
1093 c->ssl->buf->start = NULL;
2b41fbc2e39e nginx 0.6.24
Igor Sysoev <http://sysoev.ru>
parents: 358
diff changeset
1094 }
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1095 }
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1096 }
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1097
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1098
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
1099 ngx_int_t
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
1100 ngx_ssl_shutdown(ngx_connection_t *c)
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1101 {
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1102 int n, sslerr, mode;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1103 ngx_err_t err;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1104
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1105 if (c->timedout) {
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1106 mode = SSL_RECEIVED_SHUTDOWN|SSL_SENT_SHUTDOWN;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1107
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1108 } else {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1109 mode = SSL_get_shutdown(c->ssl->connection);
22
8b6db3bda591 nginx 0.1.11
Igor Sysoev <http://sysoev.ru>
parents: 18
diff changeset
1110
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1111 if (c->ssl->no_wait_shutdown) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1112 mode |= SSL_RECEIVED_SHUTDOWN;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1113 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1114
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1115 if (c->ssl->no_send_shutdown) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1116 mode |= SSL_SENT_SHUTDOWN;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1117 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1118 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1119
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1120 SSL_set_shutdown(c->ssl->connection, mode);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1121
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1122 ngx_ssl_clear_error(c->log);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1123
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1124 n = SSL_shutdown(c->ssl->connection);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1125
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1126 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_shutdown: %d", n);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1127
10
46833bd150cb nginx 0.1.5
Igor Sysoev <http://sysoev.ru>
parents: 4
diff changeset
1128 sslerr = 0;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1129
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1130 /* SSL_shutdown() never returns -1, on error it returns 0 */
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1131
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1132 if (n != 1 && ERR_peek_error()) {
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1133 sslerr = SSL_get_error(c->ssl->connection, n);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1134
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1135 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1136 "SSL_get_error: %d", sslerr);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1137 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1138
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1139 if (n == 1 || sslerr == 0 || sslerr == SSL_ERROR_ZERO_RETURN) {
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1140 SSL_free(c->ssl->connection);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1141 c->ssl = NULL;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1142
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1143 return NGX_OK;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1144 }
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1145
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1146 if (sslerr == SSL_ERROR_WANT_READ || sslerr == SSL_ERROR_WANT_WRITE) {
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1147 c->read->handler = ngx_ssl_shutdown_handler;
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1148 c->write->handler = ngx_ssl_shutdown_handler;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1149
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1150 if (ngx_handle_read_event(c->read, 0) == NGX_ERROR) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1151 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1152 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1153
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1154 if (ngx_handle_write_event(c->write, 0) == NGX_ERROR) {
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1155 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1156 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1157
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1158 if (sslerr == SSL_ERROR_WANT_READ) {
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1159 ngx_add_timer(c->read, 30000);
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1160 }
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1161
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1162 return NGX_AGAIN;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1163 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1164
140
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
1165 err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
1166
55a211e5eeb7 nginx 0.3.17
Igor Sysoev <http://sysoev.ru>
parents: 138
diff changeset
1167 ngx_ssl_connection_error(c, sslerr, err, "SSL_shutdown() failed");
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1168
92
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1169 SSL_free(c->ssl->connection);
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1170 c->ssl = NULL;
45945fa8b8ba nginx 0.2.0
Igor Sysoev <http://sysoev.ru>
parents: 90
diff changeset
1171
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1172 return NGX_ERROR;
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1173 }
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1174
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1175
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1176 static void
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1177 ngx_ssl_shutdown_handler(ngx_event_t *ev)
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1178 {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1179 ngx_connection_t *c;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1180 ngx_connection_handler_pt handler;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1181
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1182 c = ev->data;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1183 handler = c->ssl->handler;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1184
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1185 if (ev->timedout) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1186 c->timedout = 1;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1187 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1188
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1189 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ev->log, 0, "SSL shutdown handler");
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1190
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1191 if (ngx_ssl_shutdown(c) == NGX_AGAIN) {
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1192 return;
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1193 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1194
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1195 handler(c);
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1196 }
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1197
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1198
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1199 static void
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1200 ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1201 char *text)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1202 {
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1203 int n;
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1204 ngx_uint_t level;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1205
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1206 level = NGX_LOG_CRIT;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1207
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1208 if (sslerr == SSL_ERROR_SYSCALL) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1209
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1210 if (err == NGX_ECONNRESET
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1211 || err == NGX_EPIPE
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1212 || err == NGX_ENOTCONN
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1213 #if !(NGX_CRIT_ETIMEDOUT)
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1214 || err == NGX_ETIMEDOUT
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1215 #endif
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1216 || err == NGX_ECONNREFUSED
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1217 || err == NGX_ENETDOWN
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1218 || err == NGX_ENETUNREACH
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1219 || err == NGX_EHOSTDOWN
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1220 || err == NGX_EHOSTUNREACH)
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1221 {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1222 switch (c->log_error) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1223
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1224 case NGX_ERROR_IGNORE_ECONNRESET:
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1225 case NGX_ERROR_INFO:
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1226 level = NGX_LOG_INFO;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1227 break;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1228
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1229 case NGX_ERROR_ERR:
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1230 level = NGX_LOG_ERR;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1231 break;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1232
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1233 default:
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1234 break;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1235 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1236 }
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1237
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1238 } else if (sslerr == SSL_ERROR_SSL) {
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1239
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1240 n = ERR_GET_REASON(ERR_peek_error());
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1241
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1242 /* handshake failures */
370
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1243 if (n == SSL_R_DIGEST_CHECK_FAILED
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1244 || n == SSL_R_NO_SHARED_CIPHER
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1245 || n == SSL_R_UNEXPECTED_MESSAGE
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1246 || n == SSL_R_WRONG_VERSION_NUMBER
370
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1247 || n == SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1248 || n == 1000 /* SSL_R_SSLV3_ALERT_CLOSE_NOTIFY */
370
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1249 || n == SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1250 || n == SSL_R_SSLV3_ALERT_BAD_RECORD_MAC
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1251 || n == SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1252 || n == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1253 || n == SSL_R_SSLV3_ALERT_BAD_CERTIFICATE
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1254 || n == SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1255 || n == SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1256 || n == SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED
370
9a242235a80a nginx 0.6.29
Igor Sysoev <http://sysoev.ru>
parents: 366
diff changeset
1257 || n == SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1258 || n == SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1259 || n == SSL_R_TLSV1_ALERT_UNKNOWN_CA)
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1260 {
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1261 switch (c->log_error) {
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1262
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1263 case NGX_ERROR_IGNORE_ECONNRESET:
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1264 case NGX_ERROR_INFO:
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1265 level = NGX_LOG_INFO;
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1266 break;
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1267
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1268 case NGX_ERROR_ERR:
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1269 level = NGX_LOG_ERR;
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1270 break;
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1271
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1272 default:
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1273 break;
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1274 }
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1275 }
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1276 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1277
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1278 ngx_ssl_error(level, c->log, err, text);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1279 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1280
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1281
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1282 static void
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1283 ngx_ssl_clear_error(ngx_log_t *log)
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1284 {
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1285 while (ERR_peek_error()) {
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1286 ngx_ssl_error(NGX_LOG_ALERT, log, 0, "ignoring stale global SSL error");
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1287 }
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1288
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1289 ERR_clear_error();
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1290 }
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1291
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1292
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1293 void ngx_cdecl
38
2879cd3a40cb nginx 0.1.19
Igor Sysoev <http://sysoev.ru>
parents: 28
diff changeset
1294 ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, ngx_err_t err, char *fmt, ...)
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
1295 {
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1296 u_long n;
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1297 va_list args;
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1298 u_char *p, *last;
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1299 u_char errstr[NGX_MAX_CONF_ERRSTR];
10
46833bd150cb nginx 0.1.5
Igor Sysoev <http://sysoev.ru>
parents: 4
diff changeset
1300
46833bd150cb nginx 0.1.5
Igor Sysoev <http://sysoev.ru>
parents: 4
diff changeset
1301 last = errstr + NGX_MAX_CONF_ERRSTR;
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1302
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1303 va_start(args, fmt);
10
46833bd150cb nginx 0.1.5
Igor Sysoev <http://sysoev.ru>
parents: 4
diff changeset
1304 p = ngx_vsnprintf(errstr, sizeof(errstr) - 1, fmt, args);
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1305 va_end(args);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1306
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1307 p = ngx_cpystrn(p, (u_char *) " (SSL:", last - p);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1308
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1309 for ( ;; ) {
132
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1310
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1311 n = ERR_get_error();
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1312
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1313 if (n == 0) {
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1314 break;
91372f004adf nginx 0.3.13
Igor Sysoev <http://sysoev.ru>
parents: 126
diff changeset
1315 }
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1316
364
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1317 if (p >= last) {
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1318 continue;
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1319 }
a39aab45a53f nginx 0.6.26
Igor Sysoev <http://sysoev.ru>
parents: 360
diff changeset
1320
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1321 *p++ = ' ';
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1322
96
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1323 ERR_error_string_n(n, (char *) p, last - p);
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1324
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1325 while (p < last && *p) {
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1326 p++;
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1327 }
ca4f70b3ccc6 nginx 0.2.2
Igor Sysoev <http://sysoev.ru>
parents: 92
diff changeset
1328 }
0
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1329
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1330 ngx_log_error(level, log, err, "%s)", errstr);
f0b350454894 nginx 0.1.0
Igor Sysoev <http://sysoev.ru>
parents:
diff changeset
1331 }
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1332
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1333
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1334 ngx_int_t
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1335 ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1336 ssize_t builtin_session_cache, ngx_shm_zone_t *shm_zone, time_t timeout)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1337 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1338 long cache_mode;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1339
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1340 if (builtin_session_cache == NGX_SSL_NO_SCACHE) {
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1341 SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1342 return NGX_OK;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1343 }
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1344
378
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1345 if (builtin_session_cache == NGX_SSL_NONE_SCACHE) {
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1346
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1347 /*
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1348 * If the server explicitly says that it does not support
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1349 * session reuse (see SSL_SESS_CACHE_OFF above), then
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1350 * Outlook Express fails to upload a sent email to
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1351 * the Sent Items folder on the IMAP server via a separate IMAP
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1352 * connection in the background. Therefore we have a special
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1353 * mode (SSL_SESS_CACHE_SERVER|SSL_SESS_CACHE_NO_INTERNAL_STORE)
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1354 * where the server pretends that it supports session reuse,
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1355 * but it does not actually store any session.
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1356 */
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1357
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1358 SSL_CTX_set_session_cache_mode(ssl->ctx,
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1359 SSL_SESS_CACHE_SERVER
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1360 |SSL_SESS_CACHE_NO_AUTO_CLEAR
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1361 |SSL_SESS_CACHE_NO_INTERNAL_STORE);
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1362
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1363 SSL_CTX_sess_set_cache_size(ssl->ctx, 1);
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1364
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1365 return NGX_OK;
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1366 }
820f6378fc00 nginx 0.7.1
Igor Sysoev <http://sysoev.ru>
parents: 372
diff changeset
1367
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1368 cache_mode = SSL_SESS_CACHE_SERVER;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1369
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1370 if (shm_zone && builtin_session_cache == NGX_SSL_NO_BUILTIN_SCACHE) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1371 cache_mode |= SSL_SESS_CACHE_NO_INTERNAL;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1372 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1373
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1374 SSL_CTX_set_session_cache_mode(ssl->ctx, cache_mode);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1375
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1376 SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1377
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1378 if (builtin_session_cache != NGX_SSL_NO_BUILTIN_SCACHE) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1379
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1380 if (builtin_session_cache != NGX_SSL_DFLT_BUILTIN_SCACHE) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1381 SSL_CTX_sess_set_cache_size(ssl->ctx, builtin_session_cache);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1382 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1383 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1384
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1385 SSL_CTX_set_timeout(ssl->ctx, timeout);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1386
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1387 if (shm_zone) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1388 shm_zone->init = ngx_ssl_session_cache_init;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1389
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1390 SSL_CTX_sess_set_new_cb(ssl->ctx, ngx_ssl_new_session);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1391 SSL_CTX_sess_set_get_cb(ssl->ctx, ngx_ssl_get_cached_session);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1392 SSL_CTX_sess_set_remove_cb(ssl->ctx, ngx_ssl_remove_session);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1393
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1394 if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_cache_index, shm_zone)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1395 == 0)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1396 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1397 ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1398 "SSL_CTX_set_ex_data() failed");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1399 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1400 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1401 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1402
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1403 return NGX_OK;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1404 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1405
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1406
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1407 static ngx_int_t
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1408 ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1409 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1410 ngx_slab_pool_t *shpool;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1411 ngx_ssl_session_cache_t *cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1412
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1413 if (data) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1414 shm_zone->data = data;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1415 return NGX_OK;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1416 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1417
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1418 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1419
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1420 cache = ngx_slab_alloc(shpool, sizeof(ngx_ssl_session_cache_t));
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1421 if (cache == NULL) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1422 return NGX_ERROR;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1423 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1424
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1425 ngx_rbtree_init(&cache->session_rbtree, &cache->sentinel,
356
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1426 ngx_ssl_session_rbtree_insert_value);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1427
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1428 ngx_queue_init(&cache->expire_queue);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1429
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1430 shm_zone->data = cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1431
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1432 return NGX_OK;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1433 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1434
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1435
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1436 /*
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1437 * The length of the session id is 16 bytes for SSLv2 sessions and
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1438 * between 1 and 32 bytes for SSLv3/TLSv1, typically 32 bytes.
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1439 * It seems that the typical length of the external ASN1 representation
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1440 * of a session is 118 or 119 bytes for SSLv3/TSLv1.
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1441 *
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1442 * Thus on 32-bit platforms we allocate separately an rbtree node,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1443 * a session id, and an ASN1 representation, they take accordingly
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1444 * 64, 32, and 128 bytes.
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1445 *
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1446 * On 64-bit platforms we allocate separately an rbtree node + session_id,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1447 * and an ASN1 representation, they take accordingly 128 and 128 bytes.
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1448 *
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1449 * OpenSSL's i2d_SSL_SESSION() and d2i_SSL_SESSION are slow,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1450 * so they are outside the code locked by shared pool mutex
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1451 */
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1452
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1453 static int
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1454 ngx_ssl_new_session(ngx_ssl_conn_t *ssl_conn, ngx_ssl_session_t *sess)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1455 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1456 int len;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1457 u_char *p, *id, *cached_sess;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1458 uint32_t hash;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1459 SSL_CTX *ssl_ctx;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1460 ngx_shm_zone_t *shm_zone;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1461 ngx_connection_t *c;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1462 ngx_slab_pool_t *shpool;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1463 ngx_ssl_sess_id_t *sess_id;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1464 ngx_ssl_session_cache_t *cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1465 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1466
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1467 len = i2d_SSL_SESSION(sess, NULL);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1468
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1469 /* do not cache too big session */
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1470
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1471 if (len > (int) NGX_SSL_MAX_SESSION_SIZE) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1472 return 0;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1473 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1474
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1475 p = buf;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1476 i2d_SSL_SESSION(sess, &p);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1477
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1478 c = ngx_ssl_get_connection(ssl_conn);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1479
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1480 ssl_ctx = SSL_get_SSL_CTX(ssl_conn);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1481 shm_zone = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_cache_index);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1482
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1483 cache = shm_zone->data;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1484 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1485
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1486 ngx_shmtx_lock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1487
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1488 /* drop one or two expired sessions */
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1489 ngx_ssl_expire_sessions(cache, shpool, 1);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1490
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1491 cached_sess = ngx_slab_alloc_locked(shpool, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1492
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1493 if (cached_sess == NULL) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1494
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1495 /* drop the oldest non-expired session and try once more */
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1496
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1497 ngx_ssl_expire_sessions(cache, shpool, 0);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1498
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1499 cached_sess = ngx_slab_alloc_locked(shpool, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1500
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1501 if (cached_sess == NULL) {
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1502 sess_id = NULL;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1503 goto failed;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1504 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1505 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1506
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1507 sess_id = ngx_slab_alloc_locked(shpool, sizeof(ngx_ssl_sess_id_t));
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1508 if (sess_id == NULL) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1509 goto failed;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1510 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1511
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1512 #if (NGX_PTR_SIZE == 8)
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1513
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1514 id = sess_id->sess_id;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1515
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1516 #else
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1517
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1518 id = ngx_slab_alloc_locked(shpool, sess->session_id_length);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1519 if (id == NULL) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1520 goto failed;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1521 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1522
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1523 #endif
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1524
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1525 ngx_memcpy(cached_sess, buf, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1526
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1527 ngx_memcpy(id, sess->session_id, sess->session_id_length);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1528
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1529 hash = ngx_crc32_short(sess->session_id, sess->session_id_length);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1530
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1531 ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1532 "http ssl new session: %08XD:%d:%d",
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1533 hash, sess->session_id_length, len);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1534
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1535 sess_id->node.key = hash;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1536 sess_id->node.data = (u_char) sess->session_id_length;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1537 sess_id->id = id;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1538 sess_id->len = len;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1539 sess_id->session = cached_sess;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1540
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1541 sess_id->expire = ngx_time() + SSL_CTX_get_timeout(ssl_ctx);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1542
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1543 ngx_queue_insert_head(&cache->expire_queue, &sess_id->queue);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1544
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1545 ngx_rbtree_insert(&cache->session_rbtree, &sess_id->node);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1546
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1547 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1548
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1549 return 0;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1550
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1551 failed:
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1552
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1553 if (cached_sess) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1554 ngx_slab_free_locked(shpool, cached_sess);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1555 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1556
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1557 if (sess_id) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1558 ngx_slab_free_locked(shpool, sess_id);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1559 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1560
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1561 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1562
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1563 ngx_log_error(NGX_LOG_ALERT, c->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1564 "could not add new SSL session to the session cache");
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1565
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1566 return 0;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1567 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1568
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1569
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1570 static ngx_ssl_session_t *
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1571 ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn, u_char *id, int len,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1572 int *copy)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1573 {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1574 #if OPENSSL_VERSION_NUMBER >= 0x0090707fL
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1575 const
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1576 #endif
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1577 u_char *p;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1578 uint32_t hash;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1579 ngx_int_t rc;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1580 ngx_shm_zone_t *shm_zone;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1581 ngx_slab_pool_t *shpool;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1582 ngx_connection_t *c;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1583 ngx_rbtree_node_t *node, *sentinel;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1584 ngx_ssl_session_t *sess;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1585 ngx_ssl_sess_id_t *sess_id;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1586 ngx_ssl_session_cache_t *cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1587 u_char buf[NGX_SSL_MAX_SESSION_SIZE];
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1588
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1589 c = ngx_ssl_get_connection(ssl_conn);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1590
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1591 hash = ngx_crc32_short(id, (size_t) len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1592 *copy = 0;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1593
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1594 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1595 "http ssl get session: %08XD:%d", hash, len);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1596
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1597 shm_zone = SSL_CTX_get_ex_data(SSL_get_SSL_CTX(ssl_conn),
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1598 ngx_ssl_session_cache_index);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1599
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1600 cache = shm_zone->data;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1601
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1602 sess = NULL;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1603
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1604 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1605
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1606 ngx_shmtx_lock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1607
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1608 node = cache->session_rbtree.root;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1609 sentinel = cache->session_rbtree.sentinel;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1610
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1611 while (node != sentinel) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1612
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1613 if (hash < node->key) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1614 node = node->left;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1615 continue;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1616 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1617
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1618 if (hash > node->key) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1619 node = node->right;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1620 continue;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1621 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1622
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1623 /* hash == node->key */
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1624
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1625 do {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1626 sess_id = (ngx_ssl_sess_id_t *) node;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1627
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1628 rc = ngx_memn2cmp(id, sess_id->id,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1629 (size_t) len, (size_t) node->data);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1630 if (rc == 0) {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1631
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1632 if (sess_id->expire > ngx_time()) {
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1633 ngx_memcpy(buf, sess_id->session, sess_id->len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1634
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1635 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1636
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1637 p = buf;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1638 sess = d2i_SSL_SESSION(NULL, &p, sess_id->len);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1639
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1640 return sess;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1641 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1642
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1643 ngx_queue_remove(&sess_id->queue);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1644
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1645 ngx_rbtree_delete(&cache->session_rbtree, node);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1646
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1647 ngx_slab_free_locked(shpool, sess_id->session);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1648 #if (NGX_PTR_SIZE == 4)
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1649 ngx_slab_free_locked(shpool, sess_id->id);
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1650 #endif
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1651 ngx_slab_free_locked(shpool, sess_id);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1652
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1653 sess = NULL;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1654
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1655 goto done;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1656 }
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1657
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1658 node = (rc < 0) ? node->left : node->right;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1659
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1660 } while (node != sentinel && hash == node->key);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1661
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1662 break;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1663 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1664
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1665 done:
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1666
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1667 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1668
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1669 return sess;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1670 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1671
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1672
366
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1673 void
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1674 ngx_ssl_remove_cached_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1675 {
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1676 SSL_CTX_remove_session(ssl, sess);
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1677
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1678 ngx_ssl_remove_session(ssl, sess);
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1679 }
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1680
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1681
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1682 static void
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1683 ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1684 {
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1685 size_t len;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1686 u_char *id;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1687 uint32_t hash;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1688 ngx_int_t rc;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1689 ngx_shm_zone_t *shm_zone;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1690 ngx_slab_pool_t *shpool;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1691 ngx_rbtree_node_t *node, *sentinel;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1692 ngx_ssl_sess_id_t *sess_id;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1693 ngx_ssl_session_cache_t *cache;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1694
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1695 shm_zone = SSL_CTX_get_ex_data(ssl, ngx_ssl_session_cache_index);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1696
366
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1697 if (shm_zone == NULL) {
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1698 return;
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1699 }
babd3d9efb62 nginx 0.6.27
Igor Sysoev <http://sysoev.ru>
parents: 364
diff changeset
1700
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1701 cache = shm_zone->data;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1702
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1703 id = sess->session_id;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1704 len = (size_t) sess->session_id_length;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1705
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1706 hash = ngx_crc32_short(id, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1707
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1708 ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1709 "http ssl remove session: %08XD:%uz", hash, len);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1710
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1711 shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1712
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1713 ngx_shmtx_lock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1714
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1715 node = cache->session_rbtree.root;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1716 sentinel = cache->session_rbtree.sentinel;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1717
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1718 while (node != sentinel) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1719
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1720 if (hash < node->key) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1721 node = node->left;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1722 continue;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1723 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1724
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1725 if (hash > node->key) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1726 node = node->right;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1727 continue;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1728 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1729
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1730 /* hash == node->key */
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1731
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1732 do {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1733 sess_id = (ngx_ssl_sess_id_t *) node;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1734
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1735 rc = ngx_memn2cmp(id, sess_id->id, len, (size_t) node->data);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1736
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1737 if (rc == 0) {
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1738
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1739 ngx_queue_remove(&sess_id->queue);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1740
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1741 ngx_rbtree_delete(&cache->session_rbtree, node);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1742
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1743 ngx_slab_free_locked(shpool, sess_id->session);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1744 #if (NGX_PTR_SIZE == 4)
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1745 ngx_slab_free_locked(shpool, sess_id->id);
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1746 #endif
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1747 ngx_slab_free_locked(shpool, sess_id);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1748
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1749 goto done;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1750 }
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1751
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1752 node = (rc < 0) ? node->left : node->right;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1753
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1754 } while (node != sentinel && hash == node->key);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1755
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1756 break;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1757 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1758
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1759 done:
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1760
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1761 ngx_shmtx_unlock(&shpool->mutex);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1762 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1763
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1764
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1765 static void
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1766 ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1767 ngx_slab_pool_t *shpool, ngx_uint_t n)
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1768 {
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1769 time_t now;
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1770 ngx_queue_t *q;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1771 ngx_ssl_sess_id_t *sess_id;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1772
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1773 now = ngx_time();
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1774
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1775 while (n < 3) {
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1776
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1777 if (ngx_queue_empty(&cache->expire_queue)) {
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1778 return;
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1779 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1780
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1781 q = ngx_queue_last(&cache->expire_queue);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1782
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1783 sess_id = ngx_queue_data(q, ngx_ssl_sess_id_t, queue);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1784
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1785 if (n++ != 0 && sess_id->expire > now) {
332
3a91bfeffaba nginx 0.6.10
Igor Sysoev <http://sysoev.ru>
parents: 330
diff changeset
1786 return;
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1787 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1788
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1789 ngx_queue_remove(q);
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1790
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1791 ngx_log_debug1(NGX_LOG_DEBUG_EVENT, ngx_cycle->log, 0,
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1792 "expire session: %08Xi", sess_id->node.key);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1793
358
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1794 ngx_rbtree_delete(&cache->session_rbtree, &sess_id->node);
9121a0a91f47 nginx 0.6.23
Igor Sysoev <http://sysoev.ru>
parents: 356
diff changeset
1795
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1796 ngx_slab_free_locked(shpool, sess_id->session);
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1797 #if (NGX_PTR_SIZE == 4)
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1798 ngx_slab_free_locked(shpool, sess_id->id);
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1799 #endif
272
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1800 ngx_slab_free_locked(shpool, sess_id);
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1801 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1802 }
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1803
29a6403156b0 nginx 0.5.6
Igor Sysoev <http://sysoev.ru>
parents: 220
diff changeset
1804
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1805 static void
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1806 ngx_ssl_session_rbtree_insert_value(ngx_rbtree_node_t *temp,
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1807 ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1808 {
356
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1809 ngx_rbtree_node_t **p;
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1810 ngx_ssl_sess_id_t *sess_id, *sess_id_temp;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1811
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1812 for ( ;; ) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1813
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1814 if (node->key < temp->key) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1815
356
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1816 p = &temp->left;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1817
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1818 } else if (node->key > temp->key) {
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1819
356
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1820 p = &temp->right;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1821
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1822 } else { /* node->key == temp->key */
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1823
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1824 sess_id = (ngx_ssl_sess_id_t *) node;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1825 sess_id_temp = (ngx_ssl_sess_id_t *) temp;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1826
356
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1827 p = (ngx_memn2cmp(sess_id->id, sess_id_temp->id,
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1828 (size_t) node->data, (size_t) temp->data)
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1829 < 0) ? &temp->left : &temp->right;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1830 }
356
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1831
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1832 if (*p == sentinel) {
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1833 break;
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1834 }
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1835
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1836 temp = *p;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1837 }
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1838
356
b743d290eb3b nginx 0.6.22
Igor Sysoev <http://sysoev.ru>
parents: 332
diff changeset
1839 *p = node;
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1840 node->parent = temp;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1841 node->left = sentinel;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1842 node->right = sentinel;
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1843 ngx_rbt_red(node);
276
c5c2b2883984 nginx 0.5.8
Igor Sysoev <http://sysoev.ru>
parents: 274
diff changeset
1844 }
274
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1845
052a7b1d40e5 nginx 0.5.7
Igor Sysoev <http://sysoev.ru>
parents: 272
diff changeset
1846
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1847 void
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1848 ngx_ssl_cleanup_ctx(void *data)
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1849 {
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1850 ngx_ssl_t *ssl = data;
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1851
138
8e6d4d96ec4c nginx 0.3.16
Igor Sysoev <http://sysoev.ru>
parents: 132
diff changeset
1852 SSL_CTX_free(ssl->ctx);
58
b55cbf18157e nginx 0.1.29
Igor Sysoev <http://sysoev.ru>
parents: 50
diff changeset
1853 }
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1854
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
1855
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1856 ngx_int_t
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1857 ngx_ssl_get_protocol(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
160
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1858 {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1859 s->data = (u_char *) SSL_get_version(c->ssl->connection);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1860 return NGX_OK;
160
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1861 }
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1862
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1863
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1864 ngx_int_t
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1865 ngx_ssl_get_cipher_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
160
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1866 {
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1867 s->data = (u_char *) SSL_get_cipher_name(c->ssl->connection);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
1868 return NGX_OK;
160
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1869 }
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1870
73e8476f9142 nginx 0.3.27
Igor Sysoev <http://sysoev.ru>
parents: 146
diff changeset
1871
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1872 ngx_int_t
390
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1873 ngx_ssl_get_raw_certificate(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
380
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1874 {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1875 size_t len;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1876 BIO *bio;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1877 X509 *cert;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1878
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1879 s->len = 0;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1880
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1881 cert = SSL_get_peer_certificate(c->ssl->connection);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1882 if (cert == NULL) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1883 return NGX_OK;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1884 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1885
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1886 bio = BIO_new(BIO_s_mem());
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1887 if (bio == NULL) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1888 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "BIO_new() failed");
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1889 X509_free(cert);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1890 return NGX_ERROR;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1891 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1892
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1893 if (PEM_write_bio_X509(bio, cert) == 0) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1894 ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "PEM_write_bio_X509() failed");
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1895 goto failed;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1896 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1897
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1898 len = BIO_pending(bio);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1899 s->len = len;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1900
382
984bb0b1399b nginx 0.7.3
Igor Sysoev <http://sysoev.ru>
parents: 380
diff changeset
1901 s->data = ngx_pnalloc(pool, len);
380
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1902 if (s->data == NULL) {
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1903 goto failed;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1904 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1905
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1906 BIO_read(bio, s->data, len);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1907
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1908 BIO_free(bio);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1909 X509_free(cert);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1910
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1911 return NGX_OK;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1912
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1913 failed:
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1914
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1915 BIO_free(bio);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1916 X509_free(cert);
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1917
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1918 return NGX_ERROR;
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1919 }
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1920
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1921
bc21d9cd9c54 nginx 0.7.2
Igor Sysoev <http://sysoev.ru>
parents: 378
diff changeset
1922 ngx_int_t
390
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1923 ngx_ssl_get_certificate(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1924 {
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1925 u_char *p;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1926 size_t len;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1927 ngx_uint_t i;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1928 ngx_str_t cert;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1929
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1930 if (ngx_ssl_get_raw_certificate(c, pool, &cert) != NGX_OK) {
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1931 return NGX_ERROR;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1932 }
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1933
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1934 if (cert.len == 0) {
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1935 s->len = 0;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1936 return NGX_OK;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1937 }
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1938
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1939 len = cert.len - 1;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1940
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1941 for (i = 0; i < cert.len - 1; i++) {
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1942 if (cert.data[i] == LF) {
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1943 len++;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1944 }
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1945 }
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1946
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1947 s->len = len;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1948 s->data = ngx_pnalloc(pool, len);
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1949 if (s->data == NULL) {
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1950 return NGX_ERROR;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1951 }
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1952
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1953 p = s->data;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1954
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1955 for (i = 0; i < len; i++) {
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1956 *p++ = cert.data[i];
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1957 if (cert.data[i] == LF) {
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1958 *p++ = '\t';
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1959 }
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1960 }
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1961
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1962 return NGX_OK;
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1963 }
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1964
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1965
0b6053502c55 nginx 0.7.7
Igor Sysoev <http://sysoev.ru>
parents: 382
diff changeset
1966 ngx_int_t
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1967 ngx_ssl_get_subject_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1968 {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1969 char *p;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1970 size_t len;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1971 X509 *cert;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1972 X509_NAME *name;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1973
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1974 s->len = 0;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1975
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1976 cert = SSL_get_peer_certificate(c->ssl->connection);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1977 if (cert == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1978 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1979 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1980
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1981 name = X509_get_subject_name(cert);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1982 if (name == NULL) {
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
1983 X509_free(cert);
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1984 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1985 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1986
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1987 p = X509_NAME_oneline(name, NULL, 0);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1988
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1989 for (len = 0; p[len]; len++) { /* void */ }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1990
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1991 s->len = len;
382
984bb0b1399b nginx 0.7.3
Igor Sysoev <http://sysoev.ru>
parents: 380
diff changeset
1992 s->data = ngx_pnalloc(pool, len);
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1993 if (s->data == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1994 OPENSSL_free(p);
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
1995 X509_free(cert);
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1996 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1997 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1998
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
1999 ngx_memcpy(s->data, p, len);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2000
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2001 OPENSSL_free(p);
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
2002 X509_free(cert);
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2003
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2004 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2005 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2006
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2007
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2008 ngx_int_t
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2009 ngx_ssl_get_issuer_dn(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2010 {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2011 char *p;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2012 size_t len;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2013 X509 *cert;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2014 X509_NAME *name;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2015
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2016 s->len = 0;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2017
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2018 cert = SSL_get_peer_certificate(c->ssl->connection);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2019 if (cert == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2020 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2021 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2022
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2023 name = X509_get_issuer_name(cert);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2024 if (name == NULL) {
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
2025 X509_free(cert);
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2026 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2027 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2028
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2029 p = X509_NAME_oneline(name, NULL, 0);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2030
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2031 for (len = 0; p[len]; len++) { /* void */ }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2032
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2033 s->len = len;
382
984bb0b1399b nginx 0.7.3
Igor Sysoev <http://sysoev.ru>
parents: 380
diff changeset
2034 s->data = ngx_pnalloc(pool, len);
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2035 if (s->data == NULL) {
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2036 OPENSSL_free(p);
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
2037 X509_free(cert);
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2038 return NGX_ERROR;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2039 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2040
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2041 ngx_memcpy(s->data, p, len);
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2042
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2043 OPENSSL_free(p);
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
2044 X509_free(cert);
196
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2045
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2046 return NGX_OK;
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2047 }
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2048
8759b346e431 nginx 0.3.45
Igor Sysoev <http://sysoev.ru>
parents: 160
diff changeset
2049
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2050 ngx_int_t
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2051 ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2052 {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2053 size_t len;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2054 X509 *cert;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2055 BIO *bio;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2056
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2057 s->len = 0;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2058
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2059 cert = SSL_get_peer_certificate(c->ssl->connection);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2060 if (cert == NULL) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2061 return NGX_OK;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2062 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2063
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2064 bio = BIO_new(BIO_s_mem());
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2065 if (bio == NULL) {
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
2066 X509_free(cert);
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2067 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2068 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2069
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2070 i2a_ASN1_INTEGER(bio, X509_get_serialNumber(cert));
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2071 len = BIO_pending(bio);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2072
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2073 s->len = len;
382
984bb0b1399b nginx 0.7.3
Igor Sysoev <http://sysoev.ru>
parents: 380
diff changeset
2074 s->data = ngx_pnalloc(pool, len);
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2075 if (s->data == NULL) {
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2076 BIO_free(bio);
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
2077 X509_free(cert);
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2078 return NGX_ERROR;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2079 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2080
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2081 BIO_read(bio, s->data, len);
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2082 BIO_free(bio);
372
6639b93e81b2 nginx 0.6.30
Igor Sysoev <http://sysoev.ru>
parents: 370
diff changeset
2083 X509_free(cert);
220
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2084
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2085 return NGX_OK;
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2086 }
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2087
559bc7ec214e nginx 0.3.57
Igor Sysoev <http://sysoev.ru>
parents: 196
diff changeset
2088
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2089 static void *
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2090 ngx_openssl_create_conf(ngx_cycle_t *cycle)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2091 {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2092 ngx_openssl_conf_t *oscf;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
2093
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2094 oscf = ngx_pcalloc(cycle->pool, sizeof(ngx_openssl_conf_t));
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2095 if (oscf == NULL) {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2096 return NGX_CONF_ERROR;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2097 }
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
2098
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2099 /*
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2100 * set by ngx_pcalloc():
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
2101 *
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2102 * oscf->engine.len = 0;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2103 * oscf->engine.data = NULL;
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
2104 */
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2105
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2106 return oscf;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2107 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2108
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2109
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2110 static char *
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2111 ngx_openssl_init_conf(ngx_cycle_t *cycle, void *conf)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2112 {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2113 #if (NGX_SSL_ENGINE)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2114 ngx_openssl_conf_t *oscf = conf;
120
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2115
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2116 ENGINE *engine;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2117
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2118 if (oscf->engine.len == 0) {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2119 return NGX_CONF_OK;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2120 }
126
df17fbafec8f nginx 0.3.10
Igor Sysoev <http://sysoev.ru>
parents: 120
diff changeset
2121
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2122 engine = ENGINE_by_id((const char *) oscf->engine.data);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2123
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2124 if (engine == NULL) {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2125 ngx_ssl_error(NGX_LOG_WARN, cycle->log, 0,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2126 "ENGINE_by_id(\"%V\") failed", &oscf->engine);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2127 return NGX_CONF_ERROR;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2128 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2129
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2130 if (ENGINE_set_default(engine, ENGINE_METHOD_ALL) == 0) {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2131 ngx_ssl_error(NGX_LOG_WARN, cycle->log, 0,
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2132 "ENGINE_set_default(\"%V\", ENGINE_METHOD_ALL) failed",
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2133 &oscf->engine);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2134 return NGX_CONF_ERROR;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2135 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2136
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2137 ENGINE_free(engine);
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2138
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2139 #endif
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2140
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2141 return NGX_CONF_OK;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2142 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2143
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2144
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2145 #if !(NGX_SSL_ENGINE)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2146
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2147 static char *
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2148 ngx_openssl_noengine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2149 {
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2150 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
112
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
2151 "\"ssl_engine\" directive is available only in "
408f195b3482 nginx 0.3.3
Igor Sysoev <http://sysoev.ru>
parents: 108
diff changeset
2152 "OpenSSL 0.9.7 and higher,");
90
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2153
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2154 return NGX_CONF_ERROR;
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2155 }
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2156
71c46860eb55 nginx 0.1.45
Igor Sysoev <http://sysoev.ru>
parents: 88
diff changeset
2157 #endif
120
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2158
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2159
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2160 static void
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2161 ngx_openssl_exit(ngx_cycle_t *cycle)
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2162 {
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2163 #if (NGX_SSL_ENGINE)
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2164 ENGINE_cleanup();
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2165 #endif
e85dca77c46a nginx 0.3.7
Igor Sysoev <http://sysoev.ru>
parents: 112
diff changeset
2166 }